Re[2]: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

[Stephane - BasicLink]

td> Can anybody confirm that this worm is spreading on the Desktop Engine too?
td> (MSDE)

td> Thanks,
td> Trent.

td> -----Original Message-----
td> From: H D Moore [mailto:sflist@digitaloffense.net]
td> Sent: Saturday, January 25, 2003 6:49 AM
td> To: bugtraq@securityfocus.com
td> Subject: Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

<snip>

Trent,

Yes we had a Win2K server that got hit and it has never had the
full version of MSSQL Server on it. MSDE was installed as part
of MailMax 5 (a mail server) install.

Stephane

Saturday, January 25, 2003, 10:56:36 AM, you wrote:

[Arne Vidstrom]

Hi all,

The problem is that if you say that good things come out of this there will
be people out there who get inspired to write new worms with the argument
that they "do good to the society" without considering the side-effects, or
who just use it as an excuse to do damage. Also it's human nature (or
something like that) to have the opinion that if something is bad you aren't
allowed to say that it has something good in it too, but that's not really
an objective argument.

In fact the worm might have done lots of good - some of the vulnerable
databases probably contain very sensitive information. A DoS of the Internet
doesn't last forever, but if sensitive information from databases get into
the hands of the wrong people it's a long-lasting problem. Sensitive
corporate information, and especially sensitive information about
individuals, and so on. I would rather have no Internet access for a few
days than have sensitive information about myself leaked to the wrong
people. Of course the perfect solution would be if those responsible for the
databases make sure they're secure, but in a world that isn't perfect a worm
might force them to make sure they're secure. Unfortunately lot's of people
think they can neglect security as long as they don't see anything bad
happening (and they often go selectively blind on purpose). I know for a
fact that a lot of people responsible for very sensitive systems neglect
security more or less on purpose for different reasons, and their only touch
with reality is when they're struck with a worm or similar. Hopefully some
of them have learned to take security more seriously now, and hopefully some
sensitive information that would have leaked out in the future won't do so
now, because of the worm. So I believe he wrote that - seriously, I do. ;-)
That aside, I *don't* think releasing worms is a good way to solve the
problem!

/Arne


-----Original Message-----
From: John Howie [mailto:JHowie@securitytoolkit.com]
Sent: den 26 januari 2003 00:17
To: jasonc@science.org; Jay D. Dyson; Bugtraq
Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!


Jason,

I can't believe you wrote this - seriously, I can't.

>
> As of now we don't know who wrote the worm, but we do know that it
looks
> like a concept worm with no malicious payload. There is a good
argument to
> be made in favor of such worms.
>

What good can come of a widespread DoS of the Internet? What about the
problems that come hacker getting a hold of the payload and making it
more malicious before everyone can respond? Remember, most people won't
know about this until Monday and won't be able to fix the problem until
later that day, or perhaps later in the week.

>
> Before you get upset at your vendor, or anyone else's, consider the
bigger
> picture and recognize the increased security hardening the Internet
just
> received.
>

It shouldn't have needed it. Microsoft released a patch for the
vulnerability some time ago (granted it wasn't easy to install,
especially for MSDE installations) but the real problem is those system
administrators who don't apply patches when there is no good reason not
to, and the network and firewall administrators who, for some
incomprehensible reason, leave open ports like this in their firewalls
and routers.

Maybe the time has come to draft legislation to prosecute not only the
writers of such malware, but those who recklessly leave their systems
vulnerable and defenseless and, through their negligence, help propagate
malware. Lastly, Microsoft and all other vendors need to make their
patches available for all configurations and easier to install (a quick
check shows that SQL Server SP3 is still not available for MSDE).

John Howie CISSP MCSE
President, Security Toolkit LLC

[=?iso-8859-1?Q?Colm_MacC=E1rthaigh?=]

On Sat, Jan 25, 2003 at 01:53:10PM -1000, Jason Coombs wrote:
> Colm MacCarthaigh wrote:
> > If the worm had a malicious (in your terms) payload, it would have
> > caused networks just as many problems (so no gain there), and more harm
> > to MS-SQL users. Using your logic, surely this much more damaging
> > experience would have cause MS-SQL admins to be more responsible in
> > keeping up to date ? Or rather, more fearful of future exploits.
>
> Precisely my point. Sapphire was not designed to inspire fear. If this had
> been a terrorist act it would have done so, and it could have done so.

Consider that in order to exploit a target, it is counter-productive to
inspire fear within this target.

I do agree that this exploit was likely neither a Terrorist act nor primarily
designed to inpire fear. Far more likely it was designed to make headlines,
and a name for someone.

> anything actually *damaged* by Sapphire (in a physical/non-trivial sense of
> the word) was too vulnerable for use in the first place.

Unfortunatley the "anything" is the Internet, and "vulnerability" is
the CPU-bound nature of routers and the finite capacity of network links.

--
colmmacc at redbrick.dcu.ie

[Dick St.Peters]

Apparently one of my dialup users is infected, so it's likely this
does affect the DE. In 5 hours one of my access servers blocked 6008
outbound udp packets to port 1434. They were blocked because the
source addresses were randomized.

--
Dick St.Peters, stpeters@NetHeaven.com
Gatekeeper, NetHeaven, Saratoga Springs, NY

trent dilkie writes:
> Can anybody confirm that this worm is spreading on the Desktop Engine too?
> (MSDE)
>
> Thanks,
> Trent.
>
> -----Original Message-----
> From: H D Moore [mailto:sflist@digitaloffense.net]
> Sent: Saturday, January 25, 2003 6:49 AM
> To: bugtraq@securityfocus.com
> Subject: Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
>
>
> A worm which exploits a (new?) vulnerability in SQL Server is bringing the
> core routers to a grinding halt. The speed of the propagation can be
> attributed to the attack method and simplicity of the code. The worm sends
> a 376-byte UDP packet to port 1434 of each random target, each vulnerable
> system will immediately start propagating itself. Since UDP is
> connection-less, the worm is able to spread much more quickly than those
> using your standard TCP-based attack vectors (no connect timeouts).
>
> Some random screen shots, a copy of the worm as a perl script, and a
> disassembly (sorry, no comments) can be found online at:
>
> http://www.digitaloffense.net/worms/mssql_udp_worm/
>
> -HD
>
> On Saturday 25 January 2003 01:11, Michael Bacarella wrote:
> > I'm getting massive packet loss to various points on the globe. I am
> > seeing a lot of these in my tcpdump output on each host.
> >
> > 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
> > 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212
> > udp port ms-sql-m unreachable [tos 0xc0
> >
> > It looks like there's a worm affecting MS SQL Server which is
> > pingflooding addresses at some random sequence.
> >
> > All admins with access to routers should block port 1434 (ms-sql-m)!
> >
> > Everyone running MS SQL Server shut it the hell down or make sure it
> > can't access the internet proper!
> >
> > I make no guarantees that this information is correct, test it out for
> > yourself!
>
> -------------------------------------------------------
>

[trent dilkie]

Symantec has posted a new version (1.0.3) that correctly identifies an
unpatched MSDE installation.

Thanks to David @ Symantec for following up with me, the tool can be
downloaded at:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.r=
emo
val.tool.html

Trent.

-----Original Message-----
From: trent dilkie [mailto:trent@dilkie.com]=20
Sent: Monday, January 27, 2003 12:46 PM
To: 'bugtraq@securityfocus.com'
Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!



I just got a confirmation from Symantec. The fixSQLex.exe tool

(
http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.r=
emo
val.tool.html )=20

DOES NOT DETECT or fix MSDE, only SQL Server. They are working on an
update, it should be posted today.

Trent.